Here are today’s top cybersecurity stories for Monday, November 2, 2026.
Google Disrupts x.cpe Botnet of 1.3 Million Android Devices and Bans TV Box Maker
Google led a takedown of the x.cpe botnet, which lost control of its servers in late October. The botnet infected more than 1.3 million Android devices, mostly TV set-top boxes, and operators used them for ad fraud and residential proxy services. Google says it is highly confident Shenzhen-based Videostrong built the backdoor into the boxes on purpose and banned the company from supplying certified Android devices.
Synology Warns of C3RB3R Ransomware Attacks Against Outdated NAS Devices
Synology reports a surge of C3RB3R ransomware attacks against NAS devices running outdated DSM software. Attackers exploit a flaw patched in December 2024, and victims find files renamed with a .L0CK3D extension. Shadowserver tracks more than 380,000 internet-exposed Synology NAS devices.
Critical LXD and MicroCloud Flaw Lets Attackers Impersonate Trusted Clients
CVE-2026-112816 carries a CVSS score of 10.0 and lets an attacker log in as a trusted client without its private key. Canonical warns of root access to the host machine if the client has privileges. Fixes arrive in LXD 6.10.1, 5.21.9, 5.0.11, and 4.0.15, and in MicroCloud 3.4.1 and 2.1.5. A CISA assessment dated October 30 found no known exploitation.
CISA Adds Two Ivanti Connect Secure Flaws to the KEV Catalog
CISA added CVE-2026-111357, a CVSS 8.8 local privilege escalation flaw, and CVE-2026-118527, a CVSS 4.3 file upload flaw, on October 30. Volexity tracks the actor UTA0576, which chained these flaws with an authentication bypass to gain unauthenticated root access. Fixes arrive in versions 25.1.1.3 and 22.8R2.6, and the first federal deadline was November 2.
Chainalysis Confirms Intrusion Using Offensive Agentic Techniques
Chainalysis disclosed on October 30 an intrusion into its systems and internal tools earlier in the month. The attacker used offensive agentic techniques, and the exposed data included user IDs, full names, email addresses, and role labels. The company says investigation content, credentials, and session tokens were not accessed.
Hijacked DebugBear Script Drains About $2.7 Million From Polymarket Traders
On October 29, attackers replaced a page-speed script Polymarket loaded from monitoring vendor DebugBear. The code reused open sessions and took about $2.7 million from 726 wallets. Polymarket repaid 689 wallets by October 30 and is paying $1.19 million to about 5,500 wallets affected during the trading pause.
VOLTA Infostealer Uses AI Models to Rank Victims by Financial Value
Cisco Talos describes a Windows infostealer called VOLTA, which harvests browser passwords, cookies, crypto seed phrases, and session tokens. It sends an evidence bundle through OpenRouter to Claude Opus 4.6, with Kimi K2 and Gemini 2.5 Flash as fallbacks, and receives a ranked assessment of valuables. A six-slot build template suggests the malware is built for sale as a builder kit.
Sophos: Aur0ra Ransomware Group Used AI Agents for Much of Its Intrusion Work
Sophos tracks the group as GOLD OGRE and found Cursor AI artifacts showing attackers handing agents VPN logins, targets, and objectives. The agents mapped networks and Active Directory, hunted for passwords, and moved laterally, and some gained domain management access. Humans still controlled the breach and the ransomware deployment.
Apple Sends Mercenary Spyware Alerts to Users in 99 Countries
Apple sent new threat notifications to users in 99 countries, bringing its total to more than 150 countries. Recipients include journalists and documentary filmmakers. The alerts arrive shortly before final negotiations under the Pall Mall Process on commercial hacking tools.
Cloudflare Reports 18.2 Million Network-Layer DDoS Attacks in Q3, Up 38%
Cloudflare mitigated 18.2 million network-layer attacks in the third quarter, up from 13.2 million in the second. Short-burst attacks rose 208% and DNS amplification rose 215%. Attacks above 1 Tbps fell 69%, from 805 to 251.
Shared ChatGPT Link Ran Attacker Code in Victims’ Sessions Before OpenAI Fix
Parameter reported a chain of flaws through OpenAI’s bug bounty program on October 18. A malicious public share link escaped the Preview sandbox and ran code in a signed-in session, exposing private chats. OpenAI fixed the flaw on October 26 and paid $5,000, and Parameter saw no real-world exploitation.
Stay tuned for today’s in-depth analysis posts.
